# \[filebeat 8.5.3\] extracting log\_level from message with dissect processor, ignoring right padding modifier

**URL:** https://discuss.elastic.co/t/filebeat-8-5-3-extracting-log-level-from-message-with-dissect-processor-ignoring-right-padding-modifier/321683
**Category:** Beats
**Tags:** filebeat
**Created:** [December 20, 2022, 7:04pm UTC](https://discuss.elastic.co/t/filebeat-8-5-3-extracting-log-level-from-message-with-dissect-processor-ignoring-right-padding-modifier/321683 "2022-12-20T19:04:47Z")
**Posts on this page:** 3
**Page:** 1

<div class="post-metadata">

### Author: ![vincen](https://avatars.discourse-cdn.com/v4/letter/v/3bc359/32.png) [@vincen](https://discuss.elastic.co/u/vincen)
#### Post date: [December 20, 2022, 7:04pm UTC](https://discuss.elastic.co/t/filebeat-8-5-3-extracting-log-level-from-message-with-dissect-processor-ignoring-right-padding-modifier/321683/1 "2022-12-20T19:04:47Z")

</div>

I am trying to run filebeats on log files for a web application, and the messages have padding after the log level.

```auto
I:DEBUG [http-nio-8443-exec-45] RequestCasTicketValidator 20 Dec 2022 11:00:17.221: Loading custom parameters from configuration.
I:INFO [http-nio-8443-exec-45] AppCasAuthenticationProvider 20 Dec 2022 11:00:17.227: Assertion: org.jasig.cas.client.validation.AssertionImpl@6ea8611

```

I am trying to use a [right-padding modifier](https://www.elastic.co/guide/en/elasticsearch/reference/8.5/dissect-processor.html#dissect-modifier-skip-right-padding) the log level is getting parsed with the spaces included. Here's a gist showing my filebeat.yml and what I am seeing:

> <https://gist.github.com/vincenewell/8e53114263c7868fc2c6631340f99b2a>

I tried both 8.3.3 and 8.5.3 and saw the same result.

Any ideas?

---

<div class="post-metadata">

### Author: ![vincen](https://avatars.discourse-cdn.com/v4/letter/v/3bc359/32.png) [@vincen](https://discuss.elastic.co/u/vincen)
#### Post date: [December 20, 2022, 7:40pm UTC](https://discuss.elastic.co/t/filebeat-8-5-3-extracting-log-level-from-message-with-dissect-processor-ignoring-right-padding-modifier/321683/2 "2022-12-20T19:40:40Z")

</div>

I think I figured it out. Some of the log entries in this file have an IP address after\* the log level and I adjusted my tokenizer to toss it `I:%{log_level->} %{}[%{thread}] %{class} %{log_time}: `

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [January 17, 2023, 9:40pm UTC](https://discuss.elastic.co/t/filebeat-8-5-3-extracting-log-level-from-message-with-dissect-processor-ignoring-right-padding-modifier/321683/3 "2023-01-17T21:40:53Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.